From d378c630bb70689240329d4736680df717f1c8de Mon Sep 17 00:00:00 2001
From: Jackal Guo <jackalguo@google.com>
Date: Wed, 21 Dec 2022 15:11:48 +0800
Subject: [PATCH] Add new manifest attr allowUpdateOwnership (4/n)

Setting this new attr to false indicates to the platform that this
package wants to opt-out of the update ownership enforcement. This
overrides the installers' use of setRequestUpdateOwnership.

Bug: 244413073
Test: atest PackageManagerServiceUnitTests:AndroidPackageTest
Test: atest CtsPackageInstallTestCases:UpdateOwnershipEnforcementTest
Change-Id: I4b3e851b87a25583a7c43b40a7fad07ad46c3761
---
 core/api/current.txt                                  |  1 +
 core/res/res/values/attrs_manifest.xml                |  9 +++++++++
 core/res/res/values/public-staging.xml                |  1 +
 .../com/android/server/pm/InstallPackageHelper.java   |  4 ++++
 .../android/server/pm/parsing/pkg/PackageImpl.java    | 11 +++++++++++
 .../com/android/server/pm/pkg/AndroidPackage.java     |  6 ++++++
 .../android/server/pm/pkg/parsing/ParsingPackage.java |  2 ++
 .../server/pm/pkg/parsing/ParsingPackageUtils.java    |  5 ++++-
 .../pm/test/parsing/parcelling/AndroidPackageTest.kt  |  1 +
 9 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/core/api/current.txt b/core/api/current.txt
index 1acab8a443b05..8b7db18980327 100644
--- a/core/api/current.txt
+++ b/core/api/current.txt
@@ -385,6 +385,7 @@ package android {
     field public static final int allowTaskReparenting = 16843268; // 0x1010204
     field public static final int allowUndo = 16843999; // 0x10104df
     field public static final int allowUntrustedActivityEmbedding = 16844393; // 0x1010669
+    field public static final int allowUpdateOwnership;
     field public static final int alpha = 16843551; // 0x101031f
     field public static final int alphabeticModifiers = 16844110; // 0x101054e
     field public static final int alphabeticShortcut = 16843235; // 0x10101e3
diff --git a/core/res/res/values/attrs_manifest.xml b/core/res/res/values/attrs_manifest.xml
index 8ac13efba7008..ef94484f8de62 100644
--- a/core/res/res/values/attrs_manifest.xml
+++ b/core/res/res/values/attrs_manifest.xml
@@ -1783,6 +1783,14 @@
     -->
     <attr name="attributionTags" format="string" />
 
+    <!-- Default value <code>true</code> allows an installer to enable update
+         ownership enforcement for this package via {@link
+         android.content.pm.PackageInstaller.SessionParams#setRequestUpdateOwnership}
+         during initial installation. This overrides the installer's use of {@link
+         android.content.pm.PackageInstaller.SessionParams#setRequestUpdateOwnership}.
+    -->
+    <attr name="allowUpdateOwnership" format="boolean" />
+
     <!-- The <code>manifest</code> tag is the root of an
          <code>AndroidManifest.xml</code> file,
          describing the contents of an Android package (.apk) file.  One
@@ -1820,6 +1828,7 @@
         <attr name="isSplitRequired" />
         <attr name="requiredSplitTypes" />
         <attr name="splitTypes" />
+        <attr name="allowUpdateOwnership" />
     </declare-styleable>
 
     <!-- The <code>application</code> tag describes application-level components
diff --git a/core/res/res/values/public-staging.xml b/core/res/res/values/public-staging.xml
index dfd4d9a18271f..a9c56f0f802b8 100644
--- a/core/res/res/values/public-staging.xml
+++ b/core/res/res/values/public-staging.xml
@@ -124,6 +124,7 @@
     <public name="allowSharedIsolatedProcess" />
     <public name="keyboardLocale" />
     <public name="keyboardLayoutType" />
+    <public name="allowUpdateOwnership" />
   </staging-public-group>
 
   <staging-public-group type="id" first-id="0x01cd0000">
diff --git a/services/core/java/com/android/server/pm/InstallPackageHelper.java b/services/core/java/com/android/server/pm/InstallPackageHelper.java
index 8711447fd8194..ac4da2ed7d733 100644
--- a/services/core/java/com/android/server/pm/InstallPackageHelper.java
+++ b/services/core/java/com/android/server/pm/InstallPackageHelper.java
@@ -333,6 +333,10 @@ final class InstallPackageHelper {
             if (updateOwnerFromSysconfig != null) {
                 // For system app, we always use the update owner from sysconfig if presented.
                 installSource = installSource.setUpdateOwnerPackageName(updateOwnerFromSysconfig);
+            } else if (!parsedPackage.isAllowUpdateOwnership()) {
+                // If the app wants to opt-out of the update ownership enforcement via manifest,
+                // it overrides the installer's use of #setRequestUpdateOwnership.
+                installSource = installSource.setUpdateOwnerPackageName(null);
             } else if (!isApex) {
                 final boolean isUpdate = oldPkgSetting != null;
                 final String oldUpdateOwner =
diff --git a/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java b/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java
index 1778e57ce4aeb..d7c4a09d045c8 100644
--- a/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java
+++ b/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java
@@ -1809,6 +1809,11 @@ public class PackageImpl implements ParsedPackage, AndroidPackageInternal,
         return getBoolean(Booleans.VISIBLE_TO_INSTANT_APPS);
     }
 
+    @Override
+    public boolean isAllowUpdateOwnership() {
+        return getBoolean2(Booleans2.ALLOW_UPDATE_OWNERSHIP);
+    }
+
     @Override
     public boolean isVmSafeMode() {
         return getBoolean(Booleans.VM_SAFE_MODE);
@@ -2512,6 +2517,11 @@ public class PackageImpl implements ParsedPackage, AndroidPackageInternal,
         return this;
     }
 
+    @Override
+    public PackageImpl setAllowUpdateOwnership(boolean value) {
+        return setBoolean2(Booleans2.ALLOW_UPDATE_OWNERSHIP, value);
+    }
+
     @Override
     public PackageImpl sortActivities() {
         Collections.sort(this.activities, ORDER_COMPARATOR);
@@ -3726,5 +3736,6 @@ public class PackageImpl implements ParsedPackage, AndroidPackageInternal,
 
         private static final long STUB = 1L;
         private static final long APEX = 1L << 1;
+        private static final long ALLOW_UPDATE_OWNERSHIP = 1L << 2;
     }
 }
diff --git a/services/core/java/com/android/server/pm/pkg/AndroidPackage.java b/services/core/java/com/android/server/pm/pkg/AndroidPackage.java
index 78091bc494490..ad738730598fb 100644
--- a/services/core/java/com/android/server/pm/pkg/AndroidPackage.java
+++ b/services/core/java/com/android/server/pm/pkg/AndroidPackage.java
@@ -1483,4 +1483,10 @@ public interface AndroidPackage {
      * @hide
      */
     boolean isVisibleToInstantApps();
+
+    /**
+     * @see R.styleable#AndroidManifest_allowUpdateOwnership
+     * @hide
+     */
+    boolean isAllowUpdateOwnership();
 }
diff --git a/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackage.java b/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackage.java
index 69f2716a6c6e1..bb36758f1e77e 100644
--- a/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackage.java
+++ b/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackage.java
@@ -387,6 +387,8 @@ public interface ParsingPackage {
 
     ParsingPackage setLocaleConfigRes(int localeConfigRes);
 
+    ParsingPackage setAllowUpdateOwnership(boolean value);
+
     /**
      * Sets the trusted host certificates of apps that are allowed to embed activities of this
      * application.
diff --git a/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java b/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java
index 995b9e58b3e30..e7159dbf31305 100644
--- a/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java
+++ b/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java
@@ -219,6 +219,7 @@ public class ParsingPackageUtils {
     public static final int PARSE_DEFAULT_INSTALL_LOCATION =
             PackageInfo.INSTALL_LOCATION_UNSPECIFIED;
     public static final int PARSE_DEFAULT_TARGET_SANDBOX = 1;
+    public static final boolean PARSE_DEFAULT_ALLOW_UPDATE_OWNERSHIP = true;
 
     /**
      * If set to true, we will only allow package files that exactly match the DTD. Otherwise, we
@@ -883,7 +884,9 @@ public class ParsingPackageUtils {
                 .setTargetSandboxVersion(anInteger(PARSE_DEFAULT_TARGET_SANDBOX,
                         R.styleable.AndroidManifest_targetSandboxVersion, sa))
                 /* Set the global "on SD card" flag */
-                .setExternalStorage((flags & PARSE_EXTERNAL_STORAGE) != 0);
+                .setExternalStorage((flags & PARSE_EXTERNAL_STORAGE) != 0)
+                .setAllowUpdateOwnership(bool(PARSE_DEFAULT_ALLOW_UPDATE_OWNERSHIP,
+                        R.styleable.AndroidManifest_allowUpdateOwnership, sa));
 
         boolean foundApp = false;
         final int depth = parser.getDepth();
diff --git a/services/tests/PackageManagerServiceTests/unit/src/com/android/server/pm/test/parsing/parcelling/AndroidPackageTest.kt b/services/tests/PackageManagerServiceTests/unit/src/com/android/server/pm/test/parsing/parcelling/AndroidPackageTest.kt
index 8e1ca3c022642..0b7020c74f66f 100644
--- a/services/tests/PackageManagerServiceTests/unit/src/com/android/server/pm/test/parsing/parcelling/AndroidPackageTest.kt
+++ b/services/tests/PackageManagerServiceTests/unit/src/com/android/server/pm/test/parsing/parcelling/AndroidPackageTest.kt
@@ -218,6 +218,7 @@ class AndroidPackageTest : ParcelableComponentTest(AndroidPackage::class, Packag
         AndroidPackage::isAllowClearUserDataOnFailedRestore,
         AndroidPackage::isAllowNativeHeapPointerTagging,
         AndroidPackage::isAllowTaskReparenting,
+        AndroidPackage::isAllowUpdateOwnership,
         AndroidPackage::isBackupInForeground,
         AndroidPackage::isHardwareAccelerated,
         AndroidPackage::isCantSaveState,